If you read my recent post, you know that the Flickr API fully supports SSL. We’ve already updated our web and mobile apps to use HTTPS, and you no longer need to use “secure.flickr.com” to access the Flickr API via SSL. Simply update your code to call:
https://api.flickr.com/
We want communication with Flickr to be secure, all the time. So, we are tightening things up. Effective this week, all new API keys will work via HTTPS only. On June 27th, we will deprecate non-SSL access to the API. If you haven’t already made the change to HTTPS, now is the time!
Blackout Tests
In preparation for the June 27th cut-off date, we will run two “blackout” tests, each for 2 hours, so that you can ensure that API calls in your app no longer use HTTP. If you have changed your code to use HTTPS, your app should function normally during the blackout window. If you have not changed your code to use HTTPS, then during the 2-hr blackout window all API calls from your application will fail. The API will return a 403 status code for non-SSL requests.
Important Dates and Times
- Change in new API keys: 6 May 2014 (If you request a new API key after 6 May, it will be issued for HTTPS only)
- First blackout window: 3 June 2014, 10:00-12:00 Pacific Daylight Time (PDT) / 17:00-19:00 GMT
- Second blackout window: 17 June 2014, 18:00-20:00 (PDT) / 18 June 2014, 01:00-03:00 GMT
- Non-SSL calls deprecated: 27 June 2014, 10:00 (PDT) / 17:00 GMT
More About the Flickr API Endpoints
In the API documentation, all of the endpoints have been updated to HTTPS. While OAuth adds security by removing the need to authenticate by username and password, sending all traffic over SSL further protects our users’ data while in transit.
The SSL endpoints for the Flickr API are:
https://api.flickr.com/services/rest/ https://api.flickr.com/services/soap/ https://api.flickr.com/services/xmlrpc/
And for uploads:
https://up.flickr.com/services/upload/ https://up.flickr.com/services/replace/
For applications that use well-established HTTP client libraries, this switch should only require updating the protocol and (maybe) some updated configuration.
We realize that this change might be more difficult for some. We will follow the Developer Support Group closely, so please let us hear your questions. We will respond to them there, and will collect questions of general interest in the below FAQ.
FAQs About the Transition to SSL-Only for the Flickr API
Question: I only have a Flickr API key because I use an application or plugin that calls the Flickr API. Will that application or plugin continue to work after June 27th? Do I need to do something?
Answer: An application or plugin that calls the Flickr API will stop working on June 27th if its owner does not make the changes we’ve described above. There are many, many providers of such services and plugins. We have notified them about this transition via email, blog post, developer lists, and on Twitter. As a user of such a service or plugin, you have no action to do for the transition unless the application or plugin owner asks you to upgrade to a new version. You also have the option to reach out to the application or plugin owner to assure yourself of their plans to handle this transition.
Question: Are all http://www.flickr.com urls going to be HTTPS from now on?
Answer: Yes, all http://www.flickr.com urls returned by the API are now HTTPS, and all requests to HTTP in the browser are redirected to HTTPS.
Question: Should I switch my code to HTTPS right away or should I wait a bit?
Answer: Switch now. The important thing is for your app to be changed to HTTPS before the first blackout on 3 June 2014. In fact, if your app is a mobile app, the earlier the better, so that your users will be more likely to upgrade before the first blackout.
Question: Do I need a new API key to replace my old one for this transition?
Answer: No, you don’t need a new API key for this transition. You keep your existing key, and you change the code where you call the Flickr API, so that you call it with the HTTPS protocol, instead of HTTP. Change it to this:
https://api.flickr.com/
Question: What do I do with the new API key that is being issued by Flickr as of May 6?
Answer: We are not automatically issuing a new key to you. What happened on 6 May was a change to how we handle new API keys. From now on, if you submit a request for a new key, that new key will only support calls to the Flickr API over HTTPS; it will not support calls to the API over HTTP. You do not need to request a new API key for this transition.
Question: I received your email about the API going SSL-only on June 27th. Do I need to do something?
Answer: Maybe not. If you already call the API over HTTPS, then you’re good. No action needed. But if your code currently calls the API over HTTP, then, YES, you do need to do something. In your code you need to change the protocol to HTTPS. Like this:
https://api.flickr.com/
Question: If I use a protocol-less call to the API or match the protocol of the page that is making the call, do I need to change anything?
Answer: Yes, you should change your calls to specifically use HTTPS. During the blackout period and starting on June 27th, protocol-less calls to the Flickr API from non-SSL pages will fail.
Question: Will the old https://secure.flickr.com endpoints continue to be supported in addition to the new https://api.flickr.com endpoints, or will only the latter be supported?
Answer: Yes, https://secure.flickr.com endpoints will still be supported. If you use that today, your application will continue to work during the blackout windows and after 27 June.